Python/Mamba.E

公開日:2015年10月06日

危険度:2

定義名称 Python/Mamba.E
シグネチャ検査による結果だった場合 Python/Mamba.E
別名 Trojan.Python.Nastna.a(Kaspersky)、
Trojan.Agent.BLJD(BitDefender)
種別 トロイの木馬
アドバンスドヒューリスティック検査による結果だった場合 このオリジナルのトロイを利用した新種、亜種が検出された場合は、「NewHeur_PE」もしくは「Python/Mamba.Eの亜種 トロイの木馬」という名称で警告が出ます。
対応時期 バージョン12007(20150728)以降
影響を受けるプラットフォーム Microsoft Windows
概要 これは、リモートからコントロール可能なバックドア型のトロイの木馬です。詳しい活動内容については、下記をご参照ください。

検出した場合の対処方法

常駐監視を行っている各検査プログラムによって検出された場合は、駆除もしくは削除を行ってください。駆除もしくは削除ができない場合は、Windows のシステムの復元により修復しなければならない可能性があります。

対象のファイルが身に覚えのないファイル名の場合は、そのファイル自身がウイルスそのものである可能性が高いので、駆除ではなくすべて削除をしてください。これにより2次感染、3次感染を防げます。また、自分が作成したデータ等に感染していた場合は、駆除が可能な場合もありますが、駆除のボタンが押せない状態もしくは駆除しても失敗する場合は、すでに元のデータの戻せない状態までデータが書き換えられている場合もあります。この場合もすべて削除してください。

解説での表記(用語)について

以下の説明文では、環境変数を利用して各ファイルやディレクトリへのパスを表記しています。

例:
%windir% : Windowsオペレーティングシステムがインストールされたディレクトリのパス(インストール時の設定により異なる場合があります)。
%system% : %windir% のサブディレクトリである"System"や"System32"のパス。
%malwarefilepath% : マルウェアプログラムまでのパス。
%malwarefilename% : マルウェアプログラムまでのファイル名。

その他に関しては、以下のページも参考にしてください。
Microsoft Malware Protection Center - Malware help
Common Folder variables

解説

侵入(インストレーション)について

このトロイの木馬は、自身のコピーを次のフォルダーに作成する場合があります。

%appdata%\%variable1% %variable2%\

その際、次のファイル名を使用します。

%variable1% %variable2%.exe

次のファイルを作成する場合があります。

%appdata%\%variable1% %variable2%\%variable1% %variable2%.dll (10240 B, Python/Mamba.A)
%appdata%\%variable1% %variable2%\%variable3%
c:\temp\mambalog%variable4%.txt

次の名前を使用して自身をシステムサービスとして登録する場合があります。

%variable1% %variable2%

これにより、システムが起動するたびに実行されるようになります。

%variable1%は次の文字列のいずれかになります。

abrupt
acidic
adorable
adventurous
aggressive
agitated
alert
aloof
amiable
amused
annoyed
antsy
anxious
appalling
appetizing
apprehensive
arrogant
ashamed
astonishing
attractive
average
batty
beefy
bewildered
biting
bitter
bland
blushing
bored
brave
bright
broad
bulky
burly
charming
cheeky
cheerful
chubby
clean
clear
cloudy
clueless
clumsy
colorful
colossal
combative
comfortable
condemned
condescending
confused
contemplative
convincing
convoluted
cooperative
corny
costly
courageous
crabby
creepy
crooked
cruel
cumbersome
curved
cynical
dangerous
dashing
decayed
deceitful
deep
defeated
defiant
delicious
delightful
depraved
depressed
despicable
determined
dilapidated
diminutive
disgusted
distinct
distraught
distressed
disturbed
dizzy
drab
drained
dull
eager
ecstatic
elated
elegant
emaciated
embarrassed
enchanting
encouraging
energetic
enormous
enthusiastic
envious
exasperated
excited
exhilarated
extensive
exuberant
fancy
fantastic
fierce
filthy
flat
floppy
fluttering
foolish
frantic
fresh
friendly
frightened
frothy
frustrating
funny
fuzzy
gaudy
gentle
ghastly
giddy
gigantic
glamorous
gleaming
glorious
gorgeous
graceful
greasy
grieving
gritty
grotesque
grubby
grumpy
handsome
happy
harebrained
healthy
helpful
helpless
high
hollow
homely
horrific
huge
hungry
hurt
icy
ideal
immense
impressionable
intrigued
irate
irritable
itchy
jealous
jittery
jolly
joyous
filthy
flat
floppy
fluttering
foolish
frantic
fresh
friendly
frightened
frothy
frustrating
funny
fuzzy
gaudy
gentle
ghastly
giddy
gigantic
glamorous
gleaming
glorious
gorgeous
graceful
greasy
grieving
gritty
grotesque
grubby
grumpy
handsome
happy
harebrained
healthy
helpful
helpless
high
hollow
homely
horrific
huge
hungry
hurt
icy
ideal
immense
impressionable
intrigued
irate
irritable
itchy
jealous
jittery
jolly
joyous
juicy
jumpy
kind
lackadaisical
large
lazy
lethal
little
lively
livid
lonely
loose
lovely
lucky
ludicrous
macho
magnificent
mammoth
maniacal
massive
melancholy
melted
miniature
minute
mistaken
misty
moody
mortified
motionless
muddy
mysterious
narrow
nasty
naughty
nervous
nonchalant
nonsensical
nutritious
nutty
obedient
oblivious
obnoxious
odd
old-fashioned
outrageous
panicky
perfect
perplexed
petite
petty
plain
pleasant
poised
pompous
precious
prickly
proud
pungent
puny
quaint
quizzical
ratty
reassured
relieved
repulsive
responsive
ripe
robust
rotten
rotund
rough
round
salty
sarcastic
scant
scary
scattered
scrawny
selfish
shaggy
shaky
shallow
sharp
shiny
short
silky
silly
skinny
slimy
slippery
small
smarmy
smiling
smoggy
smooth
smug
soggy
solid
sore
sour
sparkling
spicy
splendid
spotless
square
stale
steady
steep
responsive
sticky
stormy
stout
straight
strange
strong
stunning
substantial
successful
succulent
superficial
superior
swanky
sweet
tart
tasty
teeny
tender
tense
terrible
testy
thankful
thick
thoughtful
thoughtless
tight
timely
tricky
trite
troubled
twitter pated
uneven
unsightly
upset
uptight
vast
vexed
victorious
virtuous
vivacious
vivid
wacky
weary
whimsical
whopping
wicked
witty
wobbly
wonderful
worried
yummy
zany
zealous
zippy

%variable2%は次の文字列のいずれかになります。

a
ability
abroad
abuse
access
accident
account
act
action
active
activity
actor
ad
addition
address
administration
adult
advance
advantage
advertising
advice
affair
affect
afternoon
age
agency
agent
agreement
air
airline
airport
alarm
alcohol
alternative
ambition
amount
analysis
analyst
anger
angle
animal
annual
answer
anxiety
anybody
anything
anywhere
apartment
appeal
appearance
apple
application
appointment
area
argument
arm
army
arrival
art
article
aside
ask
aspect
assignment
assist
assistance
assistant
associate
association
assumption
atmosphere
attack
attempt
attention
attitude
audience
author
average
award
awareness
baby
back
background
bad
bag
bake
balance
ball
band
bank
bar
base
baseball
basis
basket
bat
bath
bathroom
battle
beach
bear
beat
beautiful
bed
bedroom
beer
beginning
being
bell
belt
bench
bend
benefit
bet
beyond
bicycle
bid
big
bike
bill
bird
birth
birthday
bit
bite
bitter
black
blame
blank
blind
block
blood
blow
blue
board
boat
body
bone
bonus
book
boot
border
boss
bother
bottle
bottom
bowl
box
boy
boyfriend
brain
branch
brave
bread
break
breakfast
breast
breath
brick
bridge
brief
brilliant
broad
brother
brown
brush
buddy
budget
bug
building
bunch
burn
bus
business
button
buy
buyer
cabinet
cable
cake
calendar
call
calm
camera
camp
campaign
can
cancel
cancer
candidate
candle
candy
cap
capital
car
card
care
career
carpet
carry
case
cash
cat
catch
category
cause
celebration
cell
chain
chair
challenge
champion
championship
chance
change
channel
chapter
character
charge
charity
chart
check
cheek
chemical
chemistry
chest
chicken
child
childhood
chip
chocolate
choice
church
cigarette
city
claim
class
classic
classroom
clerk
click
client
climate
clock
closet
clothes
cloud
club
clue
coach
coast
coat
code
coffee
cold
collar
collection
college
combination
combine
comfort
comfortable
command
comment
commercial
commission
committee
common
communication
community
company
comparison
competition
complaint
complex
computer
concentrate
concept
concern
concert
conclusion
condition
conference
confidence
conflict
confusion
connection
consequence
consideration
consist
constant
construction
contact
contest
context
contract
contribution
control
conversation
convert
cook
cookie
copy
corner
cost
count
counter
country
county
couple
courage
course
court
cousin
cover
cow
crack
craft
crash
crazy
cream
creative
credit
crew
criticism
cross
cry
culture
cup
currency
current
curve
customer
cut
cycle
dad
damage
dance
dare
dark
data
database
date
daughter
day
dead
deal
dealer
dear
death
debate
debt
decision
deep
definition
degree
delay
delivery
demand
department
departure
dependent
deposit
depression
depth
description
design
designer
desire
desk
detail
development
device
devil
diamond
diet
difference
difficulty
dig
dimension
dinner
direction
director
dirt
disaster
discipline
discount
discussion
disease
dish
disk
display
distance
distribution
district
divide
doctor
document
dog
door
dot
double
doubt
draft
drag
drama
draw
drawer
drawing
dream
dress
drink
drive
driver
drop
drunk
due
dump
dust
duty
ear
earth
ease
east
eat
economics
economy
edge
editor
education
effect
effective
efficiency
effort
egg
election
elevator
emergency
emotion
emphasis
employ
employee
employer
employment
end
energy
engine
engineer
engineering
entertainment
enthusiasm
entrance
entry
environment
equal
equipment
equivalent
error
escape
essay
establishment
estate
estimate
evening
event
evidence
exam
examination
example
exchange
excitement
excuse
exercise
exit
experience
expert
explanation
expression
extension
extent
external
extreme
eye
face
fact
factor
fail
failure
fall
familiar
family
fan
farm
farmer
fat
father
fault
fear
feature
fee
feed
feedback
feel
feeling
female
few
field
fight
figure
file
fill
film
final
finance
finding
finger
finish
fire
fish
fishing
fix
flight
floor
flow
flower
fly
focus
fold
following
food
foot
football
force
forever
form
formal
fortune
foundation
frame
freedom
friend
friendship
front
fruit
fuel
fun
function
funeral
funny
future
gain
game
gap
garage
garbage
garden
gas
gate
gather
gear
gene
general
gift
girl
girlfriend
give
glad
glass
glove
go
goal
god
gold
golf
good
government
grab
grade
grand
grandfather
grandmother
grass
great
green
grocery
ground
group
growth
guarantee
guard
guess
guest
guidance
guide
guitar
guy
habit
hair
half
hall
hand
handle
hang
harm
hat
hate
head
health
hearing
heart
heat
heavy
height
hell
hello
help
hide
high
highlight
highway
hire
historian
history
hit
hold
hole
holiday
home
homework
honey
hook
hope
horror
horse
hospital
host
hotel
hour
house
housing
human
hunt
hurry
hurt
husband
ice
idea
ideal
if
illegal
image
imagination
impact
implement
importance
impress
impression
improvement
incident
income
increase
independence
independent
indication
individual
industry
inevitable
inflation
influence
information
initial
initiative
injury
insect
inside
inspection
inspector
instance
instruction
insurance
intention
interaction
interest
internal
international
internet
interview
introduction
investment
invite
iron
island
issue
it
item
jacket
job
join
joint
joke
judge
judgment
juice
jump
junior
jury
keep
key
kick
kid
kill
kind
king
kiss
kitchen
knee
knife
knowledge
lab
lack
ladder
lady
lake
land
landscape
language
laugh
law
lawyer
lay
layer
lead
leader
leadership
leading
league
leather
leave
lecture
leg
length
lesson
let
letter
level
library
lie
life
lift
light
limit
line
link
lip
list
listen
literature
living
load
loan
local
location
lock
log
long
look
loss
love
low
luck
lunch
machine
magazine
mail
main
maintenance
major
make
male
mall
man
management
manager
manner
manufacturer
many
map
march
mark
market
marketing
marriage
master
match
mate
material
math
matter
maximum
maybe
meal
meaning
measurement
meat
media
medicine
medium
meet
meeting
member
membership
memory
mention
menu
mess
message
metal
method
middle
midnight
might
milk
mind
mine
minimum
minor
minute
mirror
miss
mission
mistake
mix
mixture
mobile
mode
model
mom
moment
money
monitor
month
mood
morning
mortgage
most
mother
motor
mountain
mouse
mouth
move
movie
mud
muscle
music
nail
name
nasty
nation
national
native
natural
nature
neat
necessary
neck
negative
negotiation
nerve
net
network
news
newspaper
night
nobody
noise
normal
north
nose
note
nothing
notice
novel
number
nurse
object
objective
obligation
occasion
offer
office
officer
official
oil
one
opening
operation
opinion
opportunity
opposite
option
orange
order
ordinary
organization
original
other
outcome
outside
oven
owner
pace
pack
package
page
pain
paint
painting
pair
panic
paper
parent
park
parking
part
particular
partner
party
pass
passage
passenger
passion
past
path
patience
patient
pattern
pause
pay
payment
peace
peak
pen
penalty
pension
percentage
perception
performance
period
permission
permit
person
personal
personality
perspective
phase
philosophy
phone
photo
phrase
physical
physics
piano
pick
picture
pie
piece
pin
pipe
pitch
pizza
place
plan
plane
plant
plastic
plate
platform
play
player
pleasure
plenty
poem
poet
poetry
point
police
policy
politics
pollution
pool
pop
population
position
positive
possession
possibility
possible
post
pot
potato
potential
pound
power
practice
preference
preparation
presence
present
presentation
president
press
pressure
price
pride
priest
primary
principle
print
prior
priority
private
prize
problem
procedure
process
produce
product
profession
professional
professor
profile
profit
program
progress
project
promise
promotion
prompt
proof
property
proposal
protection
psychology
public
pull
punch
purchase
purple
purpose
push
put
quality
quantity
quarter
queen
question
quiet
quit
quote
race
radio
rain
raise
range
rate
ratio
raw
reach
reaction
read
reading
reality
reason
reception
recipe
recognition
recommendation
record
recording
recover
red
reference
reflection
refrigerator
refuse
region
register
regret
regular
relation
relationship
relative
release
relief
remote
remove
rent
repair
repeat
replacement
reply
report
representative
republic
reputation
request
requirement
research
reserve
resident
resist
resolution
resolve
resort
resource
respect
respond
response
responsibility
rest
restaurant
result
return
reveal
revenue
review
revolution
reward
rice
rich
ride
ring
rip
rise
risk
river
road
rock
role
roll
roof
room
rope
rough
round
routine
row
royal
rub
ruin
rule
run
rush
sad
safe
safety
sail
salad
salary
sale
salt
sample
sand
sandwich
satisfaction
save
savings
scale
scene
schedule
scheme
school
science
score
scratch
screen
screw
script
sea
search
season
seat
second
secret
secretary
section
sector
security
selection
self
sell
senior
sense
sensitive
sentence
series
serve
service
session
set
setting
sex
shake
shame
shape
share
she
shelter
shift
shine
ship
shirt
shock
shoe
shoot
shop
shopping
shot
shoulder
show
shower
sick
side
sign
signal
signature
significance
silly
silver
simple
sing
singer
single
sink
sir
sister
site
situation
size
skill
skin
skirt
sky
sleep
slice
slide
slip
smell
smile
smoke
snow
society
sock
soft
software
soil
solid
solution
somewhere
son
song
sort
sound
soup
source
south
space
spare
speaker
special
specialist
specific
speech
speed
spell
spend
spirit
spiritual
spite
split
sport
spot
spray
spread
spring
square
stable
staff
stage
stand
standard
star
start
state
statement
station
status
stay
steak
steal
step
stick
still
stock
stomach
stop
storage
store
storm
story
strain
stranger
strategy
street
strength
stress
stretch
strike
string
strip
stroke
structure
struggle
student
studio
study
stuff
stupid
style
subject
substance
success
suck
sugar
suggestion
suit
summer
sun
supermarket
support
surgery
surprise
surround
survey
suspect
sweet
swim
swimming
swing
switch
sympathy
system
table
tackle
tale
talk
tank
tap
target
task
taste
tax
tea
teach
teacher
teaching
team
tear
technology
telephone
television
tell
temperature
temporary
tennis
tension
term
test
text
thanks
theme
theory
thing
thought
throat
ticket
tie
till
time
tip
title
today
toe
tomorrow
tone
tongue
tonight
tool
tooth
top
topic
total
touch
tough
tour
tourist
towel
tower
town
track
trade
tradition
traffic
train
trainer
training
transition
transportation
trash
travel
treat
tree
trick
trip
trouble
truck
trust
truth
try
tune
turn
twist
two
type
uncle
understanding
union
unique
unit
university
upper
upstairs
use
user
usual
vacation
valuable
value
variation
variety
vast
vegetable
vehicle
version
video
view
village
virus
visit
visual
voice
volume
wait
wake
walk
wall
war
warning
wash
watch
water
wave
way
weakness
wealth
wear
weather
web
wedding
week
weekend
weight
weird
welcome
west
western
wheel
whereas
while
white
whole
wife
will
win
wind
window
wine
wing
winner
winter
wish
witness
woman
wonder
wood
word
work
worker
working
world
worry
worth
wrap
writer
writing
yard
year
yellow
yesterday
you
young
youth
zone

%variable3-4%には可変の文字列が入ります。

情報の取得

このトロイの木馬は、次の情報を収集します。

OSのバージョン
現在の画面解像度
OSとシステム設定に関する情報

収集した情報をリモートのコンピューターに送信しようとします。

その他の情報

このトロイの木馬は、リモートのコンピューターもしくはインターネットからデータや命令を受け取ります。

10のURLを保持しています。通信にはHTTPプロトコルが使用されます。

次を実行します。

リモートのコンピューターもしくはインターネットからファイルをダウンロードする
実行ファイルを実行する
収集した情報を送信する

次のレジストリーキーにあるさまざまな情報を保持します。

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{%variable%}]

%variable%には可変の文字列が入ります。

次のファイルにあるさまざまな情報を保持します。

%workingfolder%\%malwarefilename%.dat